vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Activity
hyperhive/nix/module-eval
History
Repository files (latest commit first)
Filename Latest commit message Latest commit date
atlas b8897e7c7a hive-priv: lock personality, deny realtime, kernel logs and module loading 
Adds LockPersonality, RestrictRealtime, ProtectKernelLogs and
ProtectKernelModules to the hive-priv unit. Nothing in hive-priv's
sources or its children uses personality(2), real-time scheduling,
/dev/kmsg, /proc/kmsg or explicit module loading.

A module-eval case pins the four directives on the rendered unit.
2026-10-16 16:06:49 +02:00
..
agent-forge-bao.nix agents: swap the agent's bao leaf in with one rename 2026-10-11 10:00:43 +02:00
agent-github-bao.nix module-eval: evaluate shared fixture configs once 2026-10-13 08:14:50 +02:00
agent-icon.nix nix: split module-eval into per-subsystem checks 2026-09-20 04:25:54 +02:00
agent-matrix.nix module-eval: evaluate shared fixture configs once 2026-10-13 08:14:50 +02:00
agent-memory.nix subagent, bash: run each subagent run and bash task in its own cgroup 2026-10-13 12:25:27 +02:00
agent-otel.nix module-eval: evaluate shared fixture configs once 2026-10-13 08:14:50 +02:00
agent-plugins.nix module-eval: evaluate shared fixture configs once 2026-10-13 08:14:50 +02:00
agent-queue-bao.nix module-eval: restore agentWith in agent-queue-bao.nix 2026-10-13 14:56:25 +02:00
agent-runtime.nix agents: swap the agent's bao leaf in with one rename 2026-10-11 10:00:43 +02:00
agent-user.nix module-eval: agent-user test asserts the heal_own_dir form 2026-10-09 11:30:30 +02:00
bao-basics.nix swarm-bao-agent-pki: decide openbao's restart on the shared locale-independent compare 2026-10-13 17:00:56 +02:00
bao-controller.nix swarm UI: an alerts page, read by the controller with a Viewer Grafana token from bao 2026-10-15 15:16:21 +02:00
bao-grants.nix swarm-victoriametrics: forward the container's journal to the swarm collector 2026-10-16 14:47:31 +02:00
bao-matrix-reader.nix module-eval: evaluate shared fixture configs once 2026-10-13 08:14:50 +02:00
bao-otel-collector.nix swarm-bao: keep the store forwarder's OIDC secret on the host's /run, not in the container's root 2026-10-15 22:39:39 +02:00
builder.nix swarm-bao-pki: enabling a service mints its client leaf on the same switch 2026-10-15 08:31:33 +02:00
core-toggle.nix hive-priv: lock personality, deny realtime, kernel logs and module loading 2026-10-16 16:06:49 +02:00
forge-placement.nix swarm-ci-runner, swarm-grafana, swarm-victorialogs: forward each container's journal to the swarm collector 2026-10-16 11:22:51 +02:00
grafana.nix gateway: service modules declare their vhost under gateway.vhosts 2026-10-16 12:47:03 +02:00
hive-otel.nix gateway: send nginx stub_status to VictoriaMetrics, add a gateway dashboard 2026-10-16 10:01:58 +02:00
hive-tls.nix gateway: serve the hive dashboard on <hive>.hives.<swarm> behind authelia, drop htpasswd 2026-10-15 21:44:27 +02:00
journald-severity.nix module-eval: assert the severity table once, not once per tier 2026-09-20 14:23:56 +02:00
lib.nix swarm-ui: package option moves to deploy.swarm-controller.ui.package 2026-10-16 00:35:16 +02:00
matrix-core.nix hive-matrix: keep tuwunel's OIDC secret on the host's /run, not in the container's root 2026-10-15 23:31:32 +02:00
name-guards.nix hive-forge, hive-matrix: forward each container's journal to the swarm collector 2026-10-16 13:50:23 +02:00
nats-authelia.nix swarm-victoriametrics: forward the container's journal to the swarm collector 2026-10-16 14:47:31 +02:00
nats-tls.nix forge: hand the OIDC client secret to forgejo from /run, not from the container's disk 2026-10-15 21:21:50 +02:00
secret-publisher.nix swarm-victoriametrics: forward the container's journal to the swarm collector 2026-10-16 14:47:31 +02:00
shared.nix module-eval: three duplicate nixosSystem fixtures come from shared.nix 2026-10-15 08:29:58 +02:00
snapshot-store.nix snapshot store: test the sender deadlines and the receiver bounds 2026-10-16 11:45:58 +02:00
swarm-otel-core.nix swarm-otel: keep the collector's OIDC secret on the host's /run, not in the container's root 2026-10-15 21:45:48 +02:00
swarm-otel-identity.nix gateway: serve the hive dashboard on <hive>.hives.<swarm> behind authelia, drop htpasswd 2026-10-15 21:44:27 +02:00
swarm-services-switch.nix swarm containers: run the claude-code the hive pins for agents 2026-10-16 01:29:15 +02:00